Case aoki-infostealer-ai-assistant-credsModel & data leakWorldwide
Aoki infostealer expands to steal Claude, ChatGPT and Cursor credentials
The Aoki (Aokigahara) infostealer, first seen earlier in 2026, now collects credentials and session files from AI coding assistants, putting developer identities and connected infrastructure at risk.
MediumAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 16, 2026
- Location
- Worldwide
- Target
- Developers' Claude, ChatGPT and Cursor credentials and sessions
- Severity
- Medium
- Triggered by
- Aoki (Aokigahara) infostealer operators
- Actor type
- Unknown
- Sector
- Multiple / cross-sector
- Reported loss
- None reported
- CVE
- None
What happened
The Aoki (Aokigahara) infostealer, first seen earlier in 2026, now collects credentials and session files from AI coding assistants, putting developer identities and connected infrastructure at risk.
Impact: Developer identities and connected infrastructure are at risk. The summary gives no victim counts or losses.
Who triggered it
Actor: Aoki (Aokigahara) infostealer operators
Attribution: Unknown; the report names only the Aoki (Aokigahara) infostealer.
Motive: Unknown; likely credential theft and access to developer infrastructure.
How it happened
Attack vector: Infostealer malware with new collection routines for AI coding assistant credentials and session files.
Root cause: Credentials and session files for AI coding assistants are stored on developer machines, where infostealers can collect them.
Timeline
- Reported by GBHackers
Response
Unknown
Current status: Ongoing
Sources (open in a new tab)
- GBHackers gbhackers.com
Cite this case
Aoki infostealer expands to steal Claude, ChatGPT and Cursor credentials. AI Threat Watch, case aoki-infostealer-ai-assistant-creds, Oct 16, 2026. https://aithreat.io/cases/aoki-infostealer-ai-assistant-creds/
Permanent link: https://aithreat.io/cases/aoki-infostealer-ai-assistant-creds/